DEV Community: Art Akopian

A scam email from the real Google

Art Akopian — Sun, 15 Nov 2026 21:51:22 +0000

Last year a phishing email showed up from no-reply@google.com. It wasn't a lookalike address. It was the real one, and it passed Google's own signature check.

The scammers got Google's system to send a real, signed message, then forwarded it on. Google first said that was working as intended. Later it said it was working on a fix.

So checking the sender isn't enough anymore.

Judge the message by what it asks you to do. If it wants you to sign in through a link, call a number in the email, or pay a new account, don't. Go to the site or app yourself.

Source: BleepingComputer, Apr 20, 2025 (news report).

The scam email that comes "from" your own company

Art Akopian — Sun, 15 Nov 2026 21:51:21 +0000

Some scam emails look like they came from inside your own company. They use the same domain and format as the payroll notices.

Microsoft 365 has a feature called Direct Send. It lets printers and apps email staff using the company's address. Microsoft says it "does not require any form of authentication." Scammers can use it too.

Microsoft added a switch to block it in April 2025. It's off by default, so someone has to turn it on.

If you run a company on Microsoft 365, ask your IT person this week whether RejectDirectSend is on. If an internal email asks you to change bank details, call the person on a number you already have.

Source: Microsoft Exchange Team Blog, Apr 28, 2025 (updated May 20, 2026).

Your bank's email can be faked, and still follow the rules

Art Akopian — Sun, 15 Nov 2026 21:51:20 +0000

Most people think email from a bank can't be faked. It can.

There's a setting called DMARC. It tells inboxes what to do with mail that pretends to be from a company. It has three options: block it, send it to spam, or do nothing.

Gmail's rules for big senders say a company has to have DMARC. But the setting is allowed to be "none," which means do nothing. That still counts as following the rules.

So a bank can be fully compliant and someone can still send you fake mail in its name.

Don't click links in bank emails. Open the app yourself.

Source: Google, Email sender guidelines (in force since Feb 1, 2024); CISA BOD 18-01 on p=none vs p=reject.